Looks like your deployment is different than usual so I limit myself to spamassassin.
You already seem to have gotten SA so far to declare the mail from a trusted source (ALL_TRUSTED), perhaps using this?
trusted_networks 212.17.35.
Further you can look at the following options:
This way you should be able to skip some tests:
shortcircuit ALL_TRUSTED on
This can be used to change the score of ALL_TRUSTED, thus making a message score so low it is not spam:
score ALL_TRUSTED -50.0